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A Method of and Apparatus for Detecting Sensor Loss in a 
Generator Control System 

The present invention relates to a method of and an apparatus for detecting sensor loss, and 
in particular voltage sensor loss, in a generator control system. 

It is desirable to be able to control the output of a generator so as to maintain the voltage 
produced by the generator within acceptable limits. However generator output voltage may 
vary with generator speed and electrical load. A variable frequency electrical generator is 
shown in Figure 1. The generator comprises a pilot exciter 1 in the form of a permanent 
magnetic generator (PMG) having a permanent magnetic rotor 2 co-operating with a three 
phase stator winding 3. Power from the stator winding 3 is provided to a stator field 
winding 5 of a main exciter 6 via a generator controller 4. The main exciter 6 has a three 
phase rotor winding 7 arranged to supply current to a main rotor winding 9 via a half wave 
bridge rectifier 8. The main rotor winding 9 co-operates with a three phase main stator 
winding 10 which is connected to the generator output 11. The permanent magnetic rotor 
2, the exciter rotor winding 7 and the main rotor winding 9 are attached to a common shaft 
12 so as to rotate together. The shaft 12 is connected via suitable coupling means (for 
example a gear box) to a prime mover, such as a gas turbine aero engine. The generator 
controller 4 is connected to the output of the generator stator windings so as to monitor the 
output voltage produced by the generator. 

It is known to reduce the current supplied to the stator field winding 5 of the exciter if the 
generator voltage rises above an acceptable threshold. Similarly, it is known to increase 
the current supplied to the stator exciter winding 5 if the output voltage of the generator 

falls below an acceptable voltage. Measurements of generator output„voltage_may_be [ 

performed on a time averaged basis and also on a peak basis. Whilst this control system - 
works well, there is a risk that complete failure of or a poor or broken connection to the 
generator output voltage sensing system within the controller 4 could result in the generator 
voltage becoming unregulated and raising to a level where equipment supplied by the 
generator may become damaged. 
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According to a first aspect of the present invention there is provided a method of detecting 
sensor failure of a generator control system having at least one voltage sensor for 
measuring a generator output voltage and at least one current sensor for measuring a 
generator output current, wherein sensor failure is indicated if, during operation of the 
generator, the measured generator output voltage is less than a first voltage threshold and 
the measured generator output current is less than a current threshold. 

It is thus possible to provide a method of detecting failure of the generator measurement 
systems, and in particular the voltage detection arrangement, within a generator control 
system. 

Preferably a purality of voltage sensors are provided. Thus, in the context of a three phase 
generator a voltage sensor may be provided to measure the voltage of each generator phase. 
The highest voltage occurring on any of the phases may then be used as a measurement of 
the generator output voltage. Thus this arrangement provides for sensor redundancy since 
the failure of any two of the three sensors can be tolerated. It might initially be supposed 
that detection of sensor failure could merely be performed by looking for a sudden 
reduction of measured output voltage. However such a system would have difficulty in 
rapidly discriminating between voltage sensor failure and output voltage collapse due to the 
occurrence of a large load or of a short circuit. It is important to be able to discriminate 
between a short circuit at the output of the generator and voltage sensor loss because they 
are treated differently by the generator control unit. If a short circuit load occurs then the 
generator should be isolated from the load but the load should not be distributed to other 
generators. However a voltage sensor loss would require immediate shut down of the 
generator but the load supplied by the generator can be transferred to other generators. 

The present invention discriminates between voltage sensor failure and transitory high load 
conditions resulting in reduction of the generator output voltage or short circuit conditions 
by monitoring the generator output current. If the generator output voltage is below or 
equal to the first voltage threshold and the current is larger than the current threshold then a 
generator overload is indicated. However, if the voltage output of the generator is 



measured to be below or equal to the first voltage threshold and the current output is less 
than or equal to the current threshold then a sensor fault is indicated. 

In the case of an overload being detected, other protection circuitry would be operated to 
protect the generator depending on the nature of the overload and/or to shed load from the 
generator, with some of the loads possibly being transferred to other power supplies 
depending on the topology of the circuit being supplied by the generator. 

Advantageously the method of detecting sensor failure is temporarily modified during 
generator start up. It should be appreciated that during generator start up the output voltage 
and output current from the generator are low thereby giving rise to the possibility that the 
method according to the present invention would erroneously indicate generator sensor 
failure as having occurred even when the sensors are functioning correctly. Preferably the 
output voltage of the generator is sampled or measured after a first time period following 
initiation of generator voltage regulation. If, at the first time period, the output voltage of 
the generator has risen to greater than a second voltage threshold then the voltage sensors 
are assumed to be functioning correctly. Preferably a second period of time is then allowed 
to elapse before the sensor detection method according to the first aspect of the present 
invention is initiated. However, if the sensor voltage fails to meet the second voltage 
threshold after the first period of time then it is assumed that the voltage sensors have 
failed and a generator shut down procedure is initiated. 

According to a second aspect of the present invention there is provided a generator control 
system having at least one voltage sensor for measuring a generator output voltage and at 
least one current sensor for measuring a generator output current, wherein the generator 
control system is arranged to shut down a controlled generator if the measured generator 
output voltage is less than a first voltage threshold and the measured generator output 
current is less than a current threshold. 

It is thus possible to provide a generator controller which can distinguish the difference 
between a reduction of measured generator output voltage due to a large or short circuit 
load occurring at the output of the generator and a reduction of measured generator output 
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voltage resulting from voltage sensor failure. Voltage sensor failure may result from 
failure of connections to the voltage sensors as well as failure of the sensors themselves or 
components responsive to the voltage sensors. 

It will be appreciated that the voltage measuring system provided for the generator is in fact 
very robust and highly unlikely to fail. However, there is always a possibility that human 
error may result in the voltage measuring system failing to be connected to the generator 
control unit following maintenance or servicing of the generator. Thus the generator 
controller according to the present invention provides protection against excessive 
generator voltages which may occur as a result of the inadvertent failure to reconnect the 
generator sensing system. The system of voltage sensor loss detection would still work if 
all the current sensors failed or were inadvertently disconnected. 

The present invention will further be described by way of example, with reference to the 
accompanying drawings, in which: 

Figure 1 schematically illustrates a three stage generator; 

Figure 2 illustrates a generator control circuit in greater detail; 

Figure 3 is a flow chart illustrating the decision process according to the present invention; 

Figure 4 is a flow chart illustrating the operation of the present invention during a start up 
phase; and 

Figure 5 is a circuit diagram for a hardware based arrangement for detecting sensor failure 
and for initiating generator shutdown. 

Figure 2 shows the control unit 4 of Figure 1 in more detail. The main exciter winding 5 
has a first end thereof connected via a field effect transistor 21 to the output of a rectifier 22 
which receives and rectifies the output of the permanent magnet generator stator windings 
3. A second end of the main exciter stator winding 5 is connected to ground via a second 
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field effect transistor 20. The main exciter stator winding 5 is also connected in parallel 
with a series circuit comprising a diode 23 and a parallel circuit comprising a resistor 24 
and a field effect transistor 25. 

The gate of the field effect transistor 20 is connected to the output of a differential 
amplifier 26 having^a first input connected to receive a first reference voltage VR1 and a 
second input connected to a rectifying averaging and conditioning circuit 27 which itself is 
connected to the generator output 1 1 . Alternatively, RMS voltage sensing may be used as 
an input to the amplifier 26. The gate of transistor 25 is connected to the output of a drive 
circuit 28 whose input is connected to the output of a comparator 29 which has a first input 
connected to the output of a peak rectifier 30. An input of the peak rectifier 30 is 
connected to the generator output 1 1 . The comparator 29 has a second input connected to a 
second reference voltage VR2. 

The gate of transistor 21 is connected to the output of a drive circuit 31 which in turn is 
connected to the output of a latch 32. The input of the latch is connected to the output of 
an AND gate 33 having a first input connected to the output of the comparator 29 and a 
second input connected to the output of a further comparator 34. The comparator 34 has a 
first input connected to receive a third reference voltage VR3 and the second input 
connected to a node formed between the winding 5 and the field effect transistor 20. 

During operation of the generator the transistors 21 and 25 are switched on so that the 
output of the rectifier 22 is supplied to the winding 5 and the resistor 24 is short circuited. 
The differential amplifier 26 compares the output voltage of the generator with a reference 
voltage VR1 representing the target output voltage and controls the transistor 20 so as to 
regulate the main exciter field by varying the current through the exciter stator winding 5. 
The current supplied by the rotor winding 7 via the rectifier 8 to the rotor winding 9 is thus 
controlled so as to vary the output of the main stator winding 10 in order to regulate the 
generator output voltage at the generator output 1 1 . 

The peak rectifier 30 monitors the instantaneous peak output voltage of the generator 
output 11. When this voltage exceeds a predetermined level represented by a voltage 
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reference VR2, the comparator 29 switches the transistor 25 off via the drive circuit 28 so 
that the resistor 24 becomes connected in series with the current recirculating path of the 
winding 5. The differential amplifier 26 will have also been arranged to have switched off 
the transistor 20 so as to remove drive to the winding 5. The recirculating current within 
the winding 5 is thus dissipated in the resistor 24 relatively rapidly so as to prevent the 
instantaneous peak output voltage of the generator from exceeding a permissible value. 

The comparator 34 compares the voltage at one end of the field winding with the reference 
voltage VR3 in order to detect the occurrence of a short circuit from the end of the field 
winding 5 to ground. When such a short circuit is detected and when the comparator 29 
signals that a large instantaneous peak output voltage has occurred, the AND gate 33 
triggers the latch 32 thereby removing drive from the transistor 21. Drive to the exciter 
winding 5 is thus removed and cannot be restored until the latch 32 is reset. 

Whilst control circuits of this type work well, they have no inherent protection against 
failure of the voltage sensors to circuits 27 and 30. This can however be rectified by 
incorporating a further logic block 50 which is responsive to the output of the peak rectifier 
30 and also to a current measuring device 52. An output of the further logic block 50 can 
be supplied to the latch 32 giving the logic block 50 the authority to operate the latch 32 so 
as to inhibit current flow through the transistor 2 1 . 

Figure 3 shows the decision process performed by the logic block 50. Control commences 
at step 60. From here, control is passed to step 62 where the output V pea k of the peak 
rectifier 30 is compared with a first voltage threshold TH v i. If the voltage is less than TH v i 
then control is passed to step 64 otherwise control loops round to the beginning of step 62 
again. At step 64 the generator output current I ou t is compared with a first current threshold 
THn. If the output current is less than TH n then control passes to step 66 which is 
indicative of a sensor failure and generator shut down is initiated by sending a signal to the 
latch 32. However, if the generator output current is greater than the first current threshold 
THn then control passes to step 68 which indicates a possible overload condition where 
generator protection measures may invoked. From step 68 control is passed back, to the 
beginning of step 62. It will be appreciated that the implementation of the flow diagram of 
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Figure 3 can be achieved equally easily in both hardware and software. A hardware 
implementation is preferred as this is likely to be more reliable. The voltage and current 
threshold chosen will vary with nominal output voltage and generator size. However for a 
115V system having a 150 KVA generator a voltage threshold of 50 Volts and a current 
threshold of 600 Amperes seem appropriate. 

Figure 4 illustrates a modification to the generator protection scheme which is initiated 
during the start up phase. Control commences at step 70 from where control is passed to 
step 72 where the sensor failure protection (i.e. generator shutdown if the voltage sensors 
are deemed to have failed) is temporarily inhibited. From step 72 control is passed to step 
74 where a test is repeatedly made to see whether generator voltage regulation has been 
enabled, which corresponds to instructing the generator to supply power. Once the 
generator voltage regulation is enabled control is passed to step 76 where a period Tl is 
timed. The period Tl is typically in range of 6 to 20 milliseconds. Control is then passed 
to step 78 where the voltage Vpeak is compared with a second voltage threshold TH V 2- 
The second voltage threshold TH V 2 typically has a value of 12 volts or so. If Vpeak is 
greater than TH V 2 then it is assumed that the voltage sensors are operating correctly and 
control is then passed to step 80 where a further period T2 of around 80 milliseconds is 
timed out before control is passed to step 82 where the sensor failure protection is 
re-enabled. Thus it will be seen that sensor failure protection is inhibited for a period of 
approximately 100 milliseconds following initiation of the instruction to the generator to 
start providing a regulated output. However, if step 78 determines that the measured 
generator peak output voltage Vpeak is less than THv2 then it is immediately assumed that 
the voltage sensors are not operating and control is passed to step 82 where the voltage 
sensor protection is enabled. This will, of course, immediately seek to determine whether 
the generator output is short circuited or whether voltage sensor failure has indeed occurred 
and will take appropriate action. 

Figure 5 schematically illustrates the circuit diagram for the logic circuit 50. The logic 
circuit comprises a comparator 90 having an inverting input connected to the output of the 
peak rectifier 30 and a non-inverting input connected to receive voltage threshold TH V i. 
An output of the comparator 90 is supplied to a first input of an AND gate 94. A second 
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cbmparator 92 has an inverting input connected to the generator output current measuring 
element 52 and a non-inverting input connected to receive the first current threshold TH n . 
An output of the comparator 92 is connected to a second input of the AND gate 94. An 
output of the AND gate 94 is connected to a first input of an electronically operated switch 
96. The switch 96 is controlled such that following generator start up it supplies the output 
of the AND gate 94 to the latch 32. However, during a generator start up phase the switch 
96 is controlled so as to disconnect the output of the AND gate 94 from the latch 32. The 
switch 96 is controlled by a timer 98 which has a first input responsive to a generator 
enable signal used to switch the generator on and the second input responsive to an output 
of a further comparator 100 which has is non-inverting input connected to receive the 
rectifier output voltage Vpeak and its inverting input connected to receive a second voltage 
reference TH V 2- Thus the comparator 100 performs the comparison of step 78. 

It is thus possible to provide a generator controller which can detect failure of its voltage 
sensing elements and initiate a generator shut down in order to ensure that devices 
connected to the generator cannot be damaged by generator over voltage. 



